THREAT ACTOR
EL-DORADO_
DormantEL-DORADO is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of EL-DORADO, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 26
- 2024 92
Leak site mirrors
7 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onionDragonForce | Oops... snapshot · 2025-03-28 19:03 -
panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onionsnapshot · 2025-12-07 03:07 -
panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onionsnapshot · 2025-12-07 03:01 -
panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onionsnapshot · 2025-02-16 23:30 -
26ubgm3vvrjawkdyfhvl2d2nhq77nu3zsagbih4yy2zgau5uv5ivfgyd.onionsnapshot · 2025-03-22 18:45 -
zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onionBlackLock snapshot · 2025-12-06 05:09 -
4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onionsnapshot · 2025-07-04 03:48
Recent victims
The 50 most recent victims claimed by EL-DORADO. Total in the index: 118.
| Date listed | Victim | Description |
|---|---|---|
| 2025-07-02 | oxforduniversal.com | Oxford Universal Corp Visitors: 11 Release DATAafter 13days22h 9m 56s … |
| 2025-06-29 | nkcustomer.com | NK Customer Solutions Visitors: 7 Release DATAafter 13days23h 27m 28s … |
| 2025-06-26 | www.ubu.ac.th | Ubon Ratchathani University Visitors: 73 Release DATAafter 13days15h 5… |
| 2025-06-25 | oliveracanarias.com | Olivera Canarias Visitors: 55 Release DATAafter 13days15h 20m 19s Ryan… |
| 2025-06-05 | www.rhmc.com.au | Ryan Harvie McEnery Visitors: 1 Release DATAafter 6days23h 44m 15s Lum… |
| 2025-06-04 | bridgestoneshepparton.com.au | Solar City Tyre Service Visitors: 150 |
| 2025-06-03 | navesinkrehab.com | Navesink Rehab Visitors: 6 |
| 2025-06-03 | solarcity.org | Solar City Visitors: 6 |
| 2025-06-03 | www.lumenation.net | Lumenation Visitors: 2 Release DATAafter 6days23h 35m 21s Solar City V… |
| 2025-06-02 | riverdellconstruction.com | Riverdell Construction Visitors: 1 Release DATAafter 6days23h 54m 38s … |
| 2025-05-30 | mcmconstructioninc.com | MCM Construction Visitors: 11 Release DATAafter 1day23h 13m 46s Neuros… |
| 2025-05-28 | quickframes.com | Quick Frames USA Visitors: 9 |
| 2025-05-28 | www.neurosurgeonsofnewjersey.com | Neurosurgeons Visitors: 4 Release DATAafter 4days23h 26m 57s Quick Fra… |
| 2025-05-28 | www.laclabichetransport.ca | Lac La Biche Transport Visitors: 6 Release DATAafter 0day23h 6m 1s Rel… |
| 2025-05-25 | www.reliance-hvac.com | Reliance Heating Visitors: 2 Release DATAafter 4days23h 24m 42s TOHO C… |
| 2025-05-16 | www.toho.co.jp | TOHO CO., LTD. Visitors: 2 Release DATAafter 1day23h 43m 5s Rees NDT I… |
| 2025-03-20 | Leave him alone, lol 😀 | |
| 2025-03-20 | Oh, is this your .env file? | |
| 2025-03-20 | It is not good... | |
| 2025-01-23 | reesndt.ca | Rees NDT Inspection Services Visitors: 323 |
| 2025-01-23 | www.reesndt.com | Rees NDT Inspection Services Visitors: 168 Release DATAafter 1day7h 13… |
| 2025-01-11 | evasair.com | EVAS Group Visitors: 592 Release DATAafter 12days13h 31m 34s Akantha V… |
| 2025-01-05 | akantha.fr | Akantha Visitors: 44 Release DATAafter 13 days 21h 9m Perú Controls S.… |
| 2025-01-04 | hasa-arg.com | HIDROCARBUROS ARGENTINOS S.A. Visitors: 11 |
| 2025-01-04 | perucontrols.com | Perú Controls S.A.C. Visitors: 8 Release DATAafter 12 days 23h 17m HID… |
| 2025-01-04 | datascan.com | Inventory Management and Counting Solutions Visitors: 11 D&G Enviro-Gr… |
| 2024-12-28 | dgenviro.com | D&G Enviro-Group Visitors: 20 Relate Infotech Visitors: 1876 LaSen Vis… |
| 2024-12-24 | relate-infotech.com | Relate Infotech Visitors: 12 LaSen Visitors: 3304 Acumen Group Visitor… |
| 2024-12-16 | acumengroup.us | Acumen Group Visitors: 37 |
| 2024-12-16 | lasen.com | LaSen Visitors: 20 Acumen Group Visitors: 37 Kandelaar Electrotechniek… |
| 2024-12-14 | www.midlandturbo.com | Midland Turbo Visitors: 16 |
| 2024-12-14 | fbchighsprings.org | First Baptist Church Visitors: 4 |
| 2024-12-14 | www.kandelaar.com | Kandelaar Electrotechniek Visitors: 6 |
| 2024-12-14 | www.lightspeeddesign.com | Light Speed Design Visitors: 9 Kandelaar Electrotechniek Visitors: 6 F… |
| 2024-11-18 | bellstaxservice.com | Bells Tax Service Visitors: 14 |
| 2024-11-18 | tiendascarrion.com | Tiendas Carrion & Fernandez Visitors: 19 |
| 2024-11-18 | www.lalucky.com | LA LUCKY Brand Visitors: 12 Tiendas Carrion & Fernandez Visitors: 19 B… |
| 2024-11-18 | www.pcafterhours.net | PC AfterHours Visitors: 0 Nations Homes Commercial & Residential Const… |
| 2024-11-09 | myrtlebeachcustomhomebuilder.com | Nations Homes Commercial & Residential Construction South Carolina, Un… |
| 2024-11-08 | barranquitas.pr.gov | The Municipal Administration of Barranquitas and its Department of Fin… |
| 2024-11-08 | seaglesafety.com | Eagle Safety Eyewear Visitors: 8 |
| 2024-11-08 | premierpackaging.com | Premier Packaging Visitors: 9 |
| 2024-11-08 | allianceind.com | Alliance Industries, LLC. Visitors: 12 |
| 2024-11-08 | uccretrievals.com | UCC Retrievals, Inc. Visitors: 15 |
| 2024-11-08 | tankerska.hr | ANKERSKA PLOVIDBA d.d. Visitors: 15 |
| 2024-11-08 | a1mobilelock.com | A-1 Mobile Lock & Key Visitors: 15 |
| 2024-11-08 | auto-recyclers.com | A & L Auto Recyclers Visitors: 16 |
| 2024-11-08 | htetech.com | HTE Technologies Visitors: 18 |
| 2024-11-08 | atd-american.com | ATD-American Visitors: 20 |
| 2024-11-08 | goughconstruction.com | Gough Construction Visitors: 24 |
CONFIRMED ATTACKS
El Dorado confirmed attacks: 11 verified incidents
Ransomnews has verified 11 El Dorado incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from December 2023 to June 2025. United States accounts for 10 of them (91%), with victims recorded in 2 countries in total. The most affected sector is government, at 2 confirmed victims. Where a figure was disclosed (6 cases), these incidents account for 112,162 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified El Dorado incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2025 | Navesink Rehab | Healthcare | New Jersey, United States | — | Unknown | Source |
| October 2024 | City of Aberdeen | Government | Washington, United States | — | Unknown | Source |
| September 2024 | Business Systems House FZ, LLC (BSH) | Finance | Dubai, United Arab Emirates | — | Unknown | Source |
| September 2024 | Howard, Howard and Hodges, CPAs | Finance | Florida, United States | 2,292 | Unknown | Source |
| April 2024 | New River Electrical Corporation | Construction | Virginia, United States | 9,845 | Unknown | Source |
| April 2024 | Adams Homes Realty, Inc. | Service | Florida, United States | 1,365 | Unknown | Source |
| March 2024 | Thunderbird Country Club | Other | California, United States | — | Unknown | Source |
| March 2024 | City of Pensacola | Government | Florida, United States | 82,469 | Unknown | Source |
| February 2024 | BakerTriangle (Baker Drywall Partnership) | Construction | Texas, United States | 15,893 | Unknown | Source |
| January 2024 | Kansas State University College of Veterinary Medicine | Education | Kansas, United States | — | Unknown | Source |
| December 2023 | TBM Consulting Group | Service | North Carolina, United States | 298 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from El Dorado's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.